Here is one sample scenario for
ORA-19811 error. I connected to target as / and tried to execute the change
command. It is giving the ORA-19811 error. You should connect to recovery
catalog database to execute the change command.

Also, you cannot use the KEEP for the
backupset in Flash Back Recovery area (FRA). You need to copy the backupset
outside of the FRA location and use the catalog backuppiece command whenever
you wanted to restore it.

ORA-19811: cannot have files in DB_RECOVERY_FILE_DEST
with keep attributes

In below mentioned example I connected to recovery
catalog and the same command successfully executed.

RMAN Change Command Restrictions and Usage Notes

The target
instance must be started.

You should
connect to recovery catalog to use The KEEP FOREVER clause.

You cannot use
CHANGE... UNAVAILABLE or KEEP attributes for files stored in the flash
recovery area.

The only CHANGE
command that requires either a manual or automatic maintenance channel is
the CHANGE ... AVAILABLE command. However, a maintenance channel is not
required when CHANGE ... AVAILABLE is used with a file that is disk only
(that is, an ARCHIVELOG, DATAFILECOPY, or CONTROLFILECOPY).

If you use
CHANGE ... AVAILABLE on files that are not disk-only, and have objects
created on device types that are not configured for automatic channels,
then issue manual maintenance commands on these channels. For example, if
you created a backup on an sbt channel, but have only a DISK channel
automatically configured, then you must manually allocate an sbt channel
before CHANGE ... AVAILABLE can operate on the backup.

Solution:

You have take the backups out of DB_RECOVERY_FILE_DEST
area. Then you can easily change the TAG retention period.